The European Electronic Communications Code

The 2002 telecoms package had been amended twice (in 2007 and 2009 by Directives 2009/136/EC and 2009/140/EC) but never recast. By 2016, when the Commission launched its Connectivity Package, significant divergence had accumulated in spectrum management, end-user rights and the regulatory treatment of over-the-top services such as WhatsApp and Skype. Investment in very high capacity networks lagged behind Commission targets. The four-directive structure made coherent reform difficult.

The European Electronic Communications Code (EECC), adopted on 11 December 2018, addresses all of these issues in a single instrument. Its most cited innovation is the explicit addition of connectivity as a fourth regulatory objective alongside competition, the internal market and the protection of end-user interests. This reorientation of the regulatory framework around VHCN roll-out runs through the entire Code: from the spectrum chapter to the co-investment remedy and the geographical survey obligations.

The Code is based on Article 114 TFEU (internal market harmonisation). It covers electronic communications networks, services, associated facilities and services, and certain aspects of terminal equipment. It does not apply to content or editorial services (covered by the AVMS Directive 2010/13/EU), to open internet access or roaming rules (Regulation (EU) 2015/2120 and Regulation (EU) 531/2012), or to radio equipment per se (Directive 2014/53/EU). The ePrivacy Directive (2002/58/EC) is expressly saved and not recast by the EECC.

The Code entered into force on 20 December 2018 (the day after OJ publication). Member States were required to transpose it by 21 December 2020, from which date the four 2002 directives were simultaneously repealed.

The Code has 127 articles in four Parts and 13 Annexes. Part I (Arts 1-41) sets out the framework: objectives, definitions, institutional governance (NRAs and BEREC), the general authorisation regime, consultation, dispute resolution, and network security. Part II (Arts 42-83) covers networks: market entry and deployment, radio spectrum, access and interconnection, SMP market analysis, ex ante remedies, and retail regulation. Part III (Arts 84-115) covers services: universal service, numbering, and end-user rights. Part IV (Arts 116-127) contains the final provisions: delegated acts, implementing acts, review, transposition and repeal.

Article 76 is the Code's signature innovation in access regulation. Where an SMP-designated undertaking offers open co-investment commitments to deploy a new very high capacity network (wholly optical fibre or equivalent), and the commitments meet the conditions in Annex IV (open access, fair terms, public disclosure, protection of access seekers, good faith, genuine commercial terms), the NRA conducts a market test. If at least one co-investment agreement has been signed, the NRA may make the commitments binding and must thereafter refrain from imposing additional SMP access obligations on the new VHCN elements for the binding period.

Co-investment commitments must be made binding for at least seven years (Art 79). This creates regulatory certainty for investors in new fibre networks: by offering open co-investment access, the operator can neutralise ex ante access obligations on the new infrastructure, provided the co-investment offer is genuinely open. BEREC has published guidelines on the consistent application of Article 76 across Member States.

Regardless of whether an undertaking has been designated as having SMP, NRAs may impose access to wiring and cables inside buildings or up to the first concentration or distribution point where replication is economically inefficient or physically impracticable (Article 61(3)). This "symmetric" obligation -- so called because it applies regardless of SMP status -- is the Code's response to the physical barrier of in-building infrastructure: it makes no commercial sense for multiple operators to install separate cabling in an apartment block.

NRAs may extend symmetric access obligations beyond the first concentration point where high and non-transitory barriers to replication exist, subject to Commission and BEREC review. BEREC guidelines on symmetric access were published by 21 December 2020. This provision effectively enables NRAs to mandate passive access in dense urban areas without needing to complete a full SMP market analysis.

Where an NRA concludes following market analysis that SMP exists and effective competition is absent, it must impose at least one remedy using the least intrusive means. The available tools are:

• Transparency (Art 69): reference offers with prices, accounting information, technical specifications, migration conditions. BEREC published minimum criteria by 21 December 2019.
• Non-discrimination (Art 70): equivalence of inputs (EoI) -- same timescales, terms, conditions, systems and processes for all access seekers including the operator itself.
• Accounting separation (Art 71): separate accounts for wholesale and internal transfer activities; transparent internal transfer prices.
• Civil engineering access (Art 72): access to buildings, entries, cables, antennae, towers, poles, masts, ducts, manholes, cabinets -- irrespective of the relevant market under analysis.
• Network element access (Art 73): local loop unbundling, active/virtual network elements, open interfaces, co-location, wholesale services for resale, interconnection, associated services (identity, location, presence).
• Price control (Art 74): cost-orientation, cost-accounting, price-squeeze prevention; reasonable return on capital accounting for investment risk; annual independent cost-accounting verification.
• Voice termination rates (Art 75): Commission Delegated Regulation (EU) 2021/654 adopted single maximum Union-wide fixed and mobile voice termination rates, reviewed every five years.
• Wholesale-only undertakings (Art 80): where the SMP undertaking has no retail presence, only non-discrimination, specific access and fair/reasonable pricing obligations apply.
• Legacy copper migration (Art 81): NRA ensures transparent decommissioning timetable and an alternative access product of at least comparable quality is available before copper withdrawal.
• Functional separation (Art 77): last resort only, prior Commission approval required; requires vertical integration to place wholesale access activities in an operationally independent entity.

Article 54 imposes binding national deadlines for two priority 5G bands. By 31 December 2020, Member States must take appropriate measures to reorganise and allow use of sufficiently large contiguous blocks of the 3.4-3.8 GHz pioneer band, and allow use of at least 1 GHz of the 24.25-27.5 GHz millimetre-wave band (subject to market demand and migration feasibility). These deadlines apply to the most commonly used international 5G bands and represent the Code's direct contribution to the 2025 5G Gigabit Society targets.

Member States must allow the transfer or lease of individual rights of use to other undertakings under the least onerous procedure. Refusals require justification: on transfer, only where there is a clear risk of inability to comply with conditions; on lease, only where the lessor will not remain liable for compliance. NRAs may impose spectrum caps, reserve spectrum for new entrants, and prohibit certain transfers to remedy post-transaction market distortions, based on an objective forward-looking market assessment (Art 52).

The 30-month rule (Art 53) requires Member States to allow use of harmonised spectrum within 30 months of adoption of the relevant technical harmonisation measure, with closely defined exceptions for security, cross-border interference, migration complexity and force majeure, each subject to two-yearly review.

NRAs must define relevant electronic communications markets following the Commission Recommendation on relevant markets (updated in 2020 as Recommendation 2020/2245) and the SMP guidelines, using a three-criteria test for markets not in the Recommendation: (a) high and non-transitory structural, legal or regulatory barriers to entry; (b) a market structure not tending towards effective competition within the relevant time horizon; (c) competition law alone insufficient to adequately address the market failure. Market reviews must be completed within five years (or three years where triggered by a revised Recommendation). Transnational markets may be defined by Commission decision on BEREC's initiative; where defined, NRAs must jointly conduct the analysis and impose remedies.

The Code substantially strengthens NRA independence requirements. NRAs must be legally and functionally independent from all undertakings providing networks, equipment or services. Heads must be appointed through open transparent selection on merit, with a minimum three-year term; dismissal is permissible only on pre-established grounds set out in law, and dismissed members may appeal to courts. NRAs must have separate annual budgets made public and sufficient staffing to participate meaningfully in BEREC activities. Only the appeal body under Article 31 may suspend or overturn NRA decisions. Member States where the state retains ownership interests in operators must ensure structural separation between regulatory and operational functions.

Article 84 requires Member States to ensure all consumers have access at an affordable price to: (a) an adequate broadband internet access service at a fixed location; and (b) voice communications services at a fixed location. "Adequate broadband internet access" must support at least the minimum set of services in Annex V and be defined using BEREC best-practices reports on national bandwidth levels. Member States may extend to non-fixed (mobile) internet access to ensure full social and economic participation.

Where retail prices are not affordable for low-income or special-needs consumers, Article 85 requires Member States to ensure affordability through direct support (vouchers or payments) or by requiring all providers to offer social tariff options or packages. Only as an exception, where this would impose an excessive burden, may Member States designate specific providers to offer social tariffs -- and even then at least a choice of providers must be ensured. Designated providers may be compensated for unfair net cost burdens, calculated under Annex VII methodology including intangible benefits of universal service provision.

Article 101 imposes full harmonisation on Articles 102-115: Member States may not maintain or introduce end-user protection provisions that differ from those provisions (whether more or less stringent). A transition period until 21 December 2021 allows retention of existing stricter national provisions in force on 20 December 2018, provided they are proportionate. Key individual provisions:

• Contract summary (Art 102): before being bound, consumers must receive a concise summary (maximum one A4 page; maximum three for bundles) covering service characteristics, price, duration, renewal/termination conditions, accessibility for disabled users, and internet access quality summary. Commission adopted a standardised template by 21 December 2019.
• Comparison tools (Art 103): competent authorities must ensure at least one independent free comparison tool for prices and quality of internet access services and number-based interpersonal communications services. Third parties may reuse published information free of charge in open data formats.
• Maximum 24-month contract (Art 105): no consumer may be locked into a commitment period longer than 24 months. After automatic renewal, termination at any time on one month's notice with no cost beyond service charges during notice. Annual best-tariff information required. Recurring significant discrepancy between actual and contracted internet service performance constitutes grounds for free termination.
• Switching and number portability (Art 106): continuity of internet access service during provider switching; maximum one working day service loss. Number portability within one working day from the agreed date. The receiving provider leads the process. Compensation mechanism for delays.
• Emergency communications (Art 109): all end-users of number-based interpersonal communications services must be able to access emergency services free of charge via 112 and national emergency numbers. Caller location information (geographic coordinates for mobile; physical address for fixed) must be provided free of charge immediately upon emergency call set-up.
• Public warning system (Art 110): by 21 June 2022, Member States must ensure public warnings for imminent major emergencies and disasters are transmitted by mobile number-based services to all end-users in affected areas. Alternative equivalent systems are permitted subject to BEREC guidelines.

Providers of public electronic communications networks and publicly available electronic communications services must take appropriate technical and organisational measures to manage the risks posed to the security of their networks and services. Measures must be proportionate to the risk, and must include, where appropriate, measures to prevent and minimise the impact of security incidents on end-users and on other networks and services. The Code explicitly mentions encryption (including end-to-end encryption where appropriate) as a measure that should be promoted and may be made mandatory by implementing act.

Providers must notify the competent authority without undue delay of security incidents that have a significant impact on the operation of networks or services. The competent authority must assess the impact using criteria including: number of users affected, duration, geographic spread, extent of functional disruption, and economic and societal impact. The competent authority may inform the public or require providers to do so where this is in the public interest. Annual summary reports on notifications received are submitted to the Commission and ENISA.

Providers must also inform end-users affected by a particular and significant risk or threat to the security of their services, and advise on protective measures end-users can take. The Commission may adopt implementing acts on technical and organisational security measures and on notification formats and procedures.

Competent authorities may issue binding security instructions, require providers to submit information and documentation, and order security audits (the cost of which is borne by the provider) conducted by qualified independent bodies or national authorities. Competent authorities may obtain assistance from national CSIRT (Computer Security Incident Response Team) units where needed. These enforcement tools ensure that Article 40 obligations are not merely aspirational: binding instructions backed by penalties (Article 29) give the security chapter practical effect. The Article 40-41 framework was subsequently amended and supplemented by the NIS 2 Directive (2022/2555/EU), which extends baseline cybersecurity requirements across a broader range of essential and important entities.